Files

T

Jordan Montgomery c70f6796a0 Add cert rollover tool, update Filevault key decryption for rollover process (#46226 )

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #46226

# Checklist for submitter

If some of the following don't apply, delete the relevant line.


- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.

## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Add CA certificate rollover CLI to renew MDM CA certs with an
extend-years option while preserving the private key and certificate
properties.
* **Improvements**
* Decryption logic updated to accept previously-rolled CA certificates
so escrowed disk-encryption keys can be decrypted after rollover.
* **Tests**
  * Expanded tests and mocks to cover rollover and decryption scenarios.
* **Chores**
* Updated ignore rules and added a changelog entry for the rollover
process.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46226?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-05-28 16:31:18 -04:00

01-Using-Fleet

Fix FileVault key escrow on ADE-enrolled Macs (#45928 )

2026-05-28 16:18:12 -04:00

Configuration

Update mysql_max_open_conns documentation (#37289 )

2026-05-28 11:43:13 -05:00

Contributing

Add cert rollover tool, update Filevault key decryption for rollover process (#46226 )

2026-05-28 16:31:18 -04:00

Deploy

Fix SAML JIT login failing when role attributes have empty values (#42874 )

2026-05-18 12:13:19 -04:00

files

…

Get started

Add Fleet dashboard image to /docs (#45970 )

2026-05-21 13:15:57 -05:00

images

Add Fleet dashboard image to /docs (#45970 )

2026-05-21 13:15:57 -05:00

REST API

Removed "experimental" warning for POST /hosts/:id/software/:software_title_id/install (#45910 )

2026-05-27 18:25:43 -05:00

solutions

Add Windows YellowKey (CVE-2026-45585) solution (#46358 )

2026-05-28 19:04:48 +02:00

mdm-commands.yml

…

queries.yml

Fix FileVault key escrow on ADE-enrolled Macs (#45928 )

2026-05-28 16:18:12 -04:00

README.md

…

scripts.yml

…

README.md

Fleet documentation

Welcome to the documentation for Fleet, the lightweight management platform for laptops and servers.

You can also read the Fleet docs over at https://fleetdm.com/docs.

Using Fleet

Resources for using the Fleet UI, fleetctl CLI, and Fleet REST API.

Deploying

Resources for installing Fleet's infrastructure dependencies, configuring Fleet, deploying osquery to hosts, and viewing example deployment scenarios.

Contributing

If you're interested in interacting with the Fleet source code, you'll find information on modifying and building the code here.

If you have any questions, please don't hesitate to File a GitHub issue or join us on Slack. You can find us in the #fleet channel.